diff --git a/ci-operator/step-registry/telcov10n/system/telco-kpis/hub-deployment/install-hub-operators/telcov10n-system-telco-kpis-hub-deployment-install-hub-operators-commands.sh b/ci-operator/step-registry/telcov10n/system/telco-kpis/hub-deployment/install-hub-operators/telcov10n-system-telco-kpis-hub-deployment-install-hub-operators-commands.sh
index e70c9a9bf99ea..9aa190ad8b822 100644
--- a/ci-operator/step-registry/telcov10n/system/telco-kpis/hub-deployment/install-hub-operators/telcov10n-system-telco-kpis-hub-deployment-install-hub-operators-commands.sh
+++ b/ci-operator/step-registry/telcov10n/system/telco-kpis/hub-deployment/install-hub-operators/telcov10n-system-telco-kpis-hub-deployment-install-hub-operators-commands.sh
@@ -48,9 +48,19 @@ main() {
 
     if [[ "${GENERATE_HUB_LOCKDOWN:-false}" == "true" ]]; then
         echo "Hub lockdown generation enabled"
+        local timestamp
+        timestamp=$(date -u +%Y%m%d_%H%M%S)
+        local lockdown_filename="lockdown-hub-temp-${timestamp}-${BUILD_ID:-0}-prow.json"
+        # hub_lockdown_output_file must be a path valid on the bastion (tasks run via SSH
+        # there). /tmp avoids any container-path or ARTIFACT_DIR availability issues.
         extra_vars+=(-e "generate_hub_lockdown=true")
         extra_vars+=(-e "hub_cluster=${HUB_CLUSTER}")
-        extra_vars+=(-e "architecture=${ARCHITECTURE:-x86_64}")
+        extra_vars+=(-e "hub_lockdown_output_file=/tmp/${lockdown_filename}")
+        # In lockdown-validation mode (HUB_LOCKDOWN_URI set) architecture is extracted
+        # from the lockdown JSON — do not override it here.
+        if [[ -z "${HUB_LOCKDOWN_URI:-}" ]]; then
+            extra_vars+=(-e "architecture=${ARCHITECTURE:-x86_64}")
+        fi
     fi
 
     ansible-playbook ./playbooks/telco-kpis/deploy-ocp-operators.yml \
diff --git a/ci-operator/step-registry/telcov10n/system/telco-kpis/mirror-ran-test-images/telcov10n-system-telco-kpis-mirror-ran-test-images-commands.sh b/ci-operator/step-registry/telcov10n/system/telco-kpis/mirror-ran-test-images/telcov10n-system-telco-kpis-mirror-ran-test-images-commands.sh
index 4fe0af044fa27..68465dca69a08 100644
--- a/ci-operator/step-registry/telcov10n/system/telco-kpis/mirror-ran-test-images/telcov10n-system-telco-kpis-mirror-ran-test-images-commands.sh
+++ b/ci-operator/step-registry/telcov10n/system/telco-kpis/mirror-ran-test-images/telcov10n-system-telco-kpis-mirror-ran-test-images-commands.sh
@@ -26,23 +26,24 @@ main() {
         exit 1
     fi
 
-    local images_file="/tmp/mirror-images-extra-vars.json"
-    python3 -c "
-import json, sys
+    # Build the images list and base64-encode it so it survives -e quoting intact.
+    # The playbook decodes with: images_b64 | b64decode | from_json
+    local images_b64
+    images_b64=$(python3 -c "
+import json, sys, base64
 raw = json.loads(sys.argv[1])
 source_images = raw.get('images', [])
 result = []
 for src in source_images:
     name_tag = src.rsplit('/', 1)[-1]
     result.append({'source': src, 'dest': 'ran-test/' + name_tag})
-with open(sys.argv[2], 'w') as f:
-    json.dump({'images': result}, f)
-print(f'Mirroring {len(result)} image(s)')
-" "${RAN_IMAGES}" "${images_file}"
+print(f'Mirroring {len(result)} image(s)', file=sys.stderr)
+print(base64.b64encode(json.dumps(result).encode()).decode())
+" "${RAN_IMAGES}")
 
     ansible-playbook ./playbooks/telco-kpis/mirror-images.yml \
         -i ./inventories/ocp-deployment/build-inventory.py \
-        -e "@${images_file}" \
+        -e "images_b64=${images_b64}" \
         -e "registry_host=disconnected.registry.local" \
         ${DEBUG_FLAG}
 
diff --git a/ci-operator/step-registry/telcov10n/system/telco-kpis/spoke-deployment/mirror-spoke-operators/telcov10n-system-telco-kpis-spoke-deployment-mirror-spoke-operators-commands.sh b/ci-operator/step-registry/telcov10n/system/telco-kpis/spoke-deployment/mirror-spoke-operators/telcov10n-system-telco-kpis-spoke-deployment-mirror-spoke-operators-commands.sh
index b4a471dac09e8..871bfd560e8d1 100644
--- a/ci-operator/step-registry/telcov10n/system/telco-kpis/spoke-deployment/mirror-spoke-operators/telcov10n-system-telco-kpis-spoke-deployment-mirror-spoke-operators-commands.sh
+++ b/ci-operator/step-registry/telcov10n/system/telco-kpis/spoke-deployment/mirror-spoke-operators/telcov10n-system-telco-kpis-spoke-deployment-mirror-spoke-operators-commands.sh
@@ -41,9 +41,21 @@ main() {
 
     if [[ "${GENERATE_SPOKE_LOCKDOWN:-false}" == "true" ]]; then
         echo "Spoke lockdown generation enabled"
-        extra_vars+=(-e "generate_spoke_lockdown=true")
+        local timestamp
+        timestamp=$(date -u +%Y%m%d_%H%M%S)
+        local lockdown_filename="lockdown-spoke-${VERSION:-unknown}-${ARCHITECTURE:-x86_64}-${timestamp}-${BUILD_ID:-0}-prow.json"
+        # lockdown_output_file is what the playbook checks to trigger generation:
+        #   ocp_operator_mirror_generate_lockdown: "{{ (lockdown_output_file | default('') | length > 0) }}"
+        # Write to /tmp on the bastion (tasks run via SSH there, not inside the container).
+        extra_vars+=(-e "lockdown_output_file=/tmp/${lockdown_filename}")
         extra_vars+=(-e "hub_name=${HUB_CLUSTER}")
-        extra_vars+=(-e "architecture=${ARCHITECTURE:-x86_64}")
+        # Prow exposes BUILD_ID; use it as build_number for lockdown metadata.
+        extra_vars+=(-e "build_number=${BUILD_ID:-0}")
+        # In lockdown-validation mode (SPOKE_LOCKDOWN_URI set) architecture is extracted
+        # from the lockdown JSON — do not override it here.
+        if [[ -z "${SPOKE_LOCKDOWN_URI:-}" ]]; then
+            extra_vars+=(-e "architecture=${ARCHITECTURE:-x86_64}")
+        fi
     fi
 
     ansible-playbook ./playbooks/telco-kpis/mirror-spoke-operators.yml \